Overview
- Keystone detected unauthorized access to its official website on October 20 and said it confirmed on October 23, after reviewing Shopify API activity, that a third party obtained customer shipping and order records.
- The company says the stolen records include names, emails, phone numbers, shipping addresses and purchase details while payment card data, wallet passwords, private keys and recovery phrases were not accessed.
- In response Keystone says it blocked the breach, patched the vulnerability, began emailing affected customers and opened a formal investigation with a promise to publish a detailed incident report.
- Keystone has not identified the attacker, disclosed how long data was exposed, or revealed how many customers were affected or the precise technical access method.
- The incident matches several 2026 cases where order or fulfillment systems, not wallet cryptography, were exposed and creates real risks of targeted phishing, fake replacement-device scams and physical attacks on buyers.